Which statement is correct about global security policies on SRX Series devices?

Global security policies on SRX Series devices are configured to match traffic between any source zone and any destination zone (from-zone any to-zone any). While the policy's match criteria are zone-agnostic, the Junos OS processing engine is aware of the packet's actual ingress and egress zones. When a packet matches a global policy, a session is created, and the specific zone information is stored in the session table and included in system log messages. Therefore, the application and effect of a global policy inherently include and preserve the zone context of the traffic flow.

A. The to-zone any command configures a global policy. Incorrect. A global policy is defined by the combination of from-zone any and to-zone any, not by a single directive.
B. The from-zone any command configures a global policy. Incorrect. A global policy requires both from-zone any and to-zone any to be considered global in scope.
C. Global policies are always evaluated first. Incorrect. SRX Series devices evaluate specific zone-to-zone policies first. Global policies are only evaluated if no specific policy match is found.

1. Juniper Networks TechLibrary

"Understanding Global Policies": This document states

"A global policy is a security policy that uses any as the value for the from-zone and to-zone." It also clarifies the lookup order: "When a packet is received

the device first checks for a policy that matches the from-zone and to-zone pair. If no match is found

the device checks for a global policy that matches the packet." This confirms options A

B

and C are incorrect.

URL: https://www.juniper.net/documentation/us/en/software/junos/security-policies/topics/concept/security-policy-global-understanding.html

2. Juniper Networks TechLibrary

"show security flow session": The output of this command demonstrates that even for traffic matched by a global policy

the session table explicitly lists the specific In (ingress) and Out (egress) interfaces and their associated zones. This proves that zone context is maintained

supporting the correctness of option D.

URL: https://www.juniper.net/documentation/us/en/software/junos/security-monitoring-troubleshooting/topics/ref/command/show-security-flow-session.html